Critical severity · published Aug 14, 2019
CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
In wildKEV
9.8
CVSS
7.5%
EPSS
Yes
On KEV
Description
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 30, 2024
Federal remediation dueOct 21, 2024
Ransomware campaign useNot known
Affected products
Which versions
SC
SAP Commerce Cloud (virtualjdbc extension) · SAP SE
< 6.4; < 6.5; < 6.6; < 6.7; < 1808; < 1811; +1 more · source: vendor
CC
Commerce Cloud · Sap
6.4; 6.5; 6.6; 6.7; 1808; 1811; +1 more · source: NVD, CISA, KEV
Affected product
SC
SAP Commerce Cloud (virtualjdbc extension)
SAP SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0344
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2786035